Find & release quarantined messages in Exchange Online
Find & release quarantined messages in Exchange Online
In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, quarantine holds potentially dangerous or unwanted messages.
You view and manage your quarantined messages in the Microsoft 365 Defender portal or quarantine notifications from quarantine policies.
What do you need to know before you begin?
- By default, messages that were quarantined for high confidence phishing, malware, or by mail flow rules are only available to admins, and aren't visible to users.
View your quarantined messages
- To go directly to the Quarantine page, use https://security.microsoft.com/quarantine.
- On the Quarantine page, you can sort the results by clicking on an available column header. Click Customize columns to change the columns that are shown. The default values are marked with an asterisk (
- To filter the results, click Filter.
- Use Search box and a corresponding value to find specific messages. Wildcards aren't supported. You can search by the following values:
- Message ID
- Sender email address
- Recipient email address
- Subject. Use the entire subject of the message. The search is not case-sensitive.
- Policy name. Use the entire policy name. The search is not case-sensitive.
After you find a specific quarantined message, select the message to view details about it, and to take action on it (for example, view, release, download, or delete the message).
View quarantined message details
When you select quarantined message from the list, the following information is available in the details flyout that appears.
To take action on the message, see the next section.
Take action on quarantined email
After you select a quarantined message from the list, the following actions are available in the details flyout:
- Copy message header: Click this link to copy the message header (all header fields) to your clipboard.
- Microsoft Message Header Analyzer: To analyze the header fields and values in depth, click this link to go to the Message Header Analyzer. Paste the message header into the Insert the message header you would like to analyze section (CTRL+V or right-click and choose Paste), and then click Analyze headers.
If you don't release or remove the message, it will be deleted after the default quarantine retention period expires (as shown in the Expires column).
Note
On a mobile device, the description text isn't available on the action icons.
The icons in order and their corresponding descriptions are summarized in the following table:
Icon | Description |
Release email |  |
View message headers |  |
Preview message |  |
Remove from quarantine |  |
Block sender |  |
Take action on multiple quarantined email messages
When you select multiple quarantined messages in the list (up to 100) by clicking in the blank area to the left of the first column, the Bulk actions drop down list appears where you can take the following actions:
- Release
- Delete
